CVE-2024-8984

Published: Mar 20, 2025Modified: Jun 17, 2026

7.5

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: security@huntr.dev (Secondary)

Description

A Denial of Service (DoS) vulnerability exists in berriai/litellm version v1.44.5. This vulnerability can be exploited by appending characters, such as dashes (-), to the end of a multipart boundary in an HTTP request. The server continuously processes each character, leading to excessive resource consumption and rendering the service unavailable. The issue is unauthenticated and does not require any user interaction, impacting all users of the service.

Affected (5)

Products: Litellm: Litellm

Litellm

1 product

Litellm

Configuration A

5 vulnerable

Vulnerable Software	Affected Versions
Litellm Litellm	Before 1.65.4
Litellm Litellm	Version 1.65.4 dev2
Litellm Litellm	Version 1.65.4 dev6
Litellm Litellm	Version 1.65.4 dev8
Litellm Litellm	Version 1.65.4 nightly

Related CWEs

CWE-770

Allocation of Resources Without Limits or Throttling

The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.

References (2)

https://github.com/berriai/litellm/commit/4f49f836aa844ac9b6bfbeff27e6f6b2b9cf3f61

Source: security@huntr.dev

https://huntr.com/bounties/554fc76b-3097-4223-b4cf-110b853e9355

Source: security@huntr.dev

ExploitThird Party Advisory

Timeline

No history available yet.